74 lines
3.3 KiB
TypeScript
74 lines
3.3 KiB
TypeScript
export const PLUGIN_SETTING_KEY_MAX_LENGTH = 128;
|
|
export const PLUGIN_SETTING_VALUE_MAX_BYTES = 32 * 1024;
|
|
export const PLUGIN_SETTING_VALUE_MAX_DEPTH = 8;
|
|
export const PLUGIN_SETTING_VALUE_MAX_NODES = 2048;
|
|
export const PLUGIN_SETTING_ARRAY_MAX_LENGTH = 512;
|
|
export const PLUGIN_SETTING_OBJECT_MAX_KEYS = 256;
|
|
|
|
const SAFE_PLUGIN_SETTING_KEY_PATTERN = /^[a-zA-Z0-9._:-]{1,128}$/u;
|
|
const SECRET_LIKE_SETTING_KEY_PATTERN =
|
|
/(?:secret|token|password|credential|authorization|auth[-_.:]|[-_.:]auth(?:$|[-_.:])|bearer|cookie|session|private[-_.:]?key|client[-_.:]?secret|webhook|apikey|api[-_.:]?key)/iu;
|
|
const RESERVED_PLUGIN_SETTING_KEYS = new Set(["__proto__", "constructor", "prototype"]);
|
|
|
|
export type PluginSettingValue = null | string | number | boolean | PluginSettingValue[] | { readonly [key: string]: PluginSettingValue };
|
|
|
|
export function isPluginSettingKeyFormatSafe(value: unknown): value is string {
|
|
return typeof value === "string" && SAFE_PLUGIN_SETTING_KEY_PATTERN.test(value);
|
|
}
|
|
|
|
export function isPluginSettingKeyReserved(value: string): boolean {
|
|
return RESERVED_PLUGIN_SETTING_KEYS.has(value);
|
|
}
|
|
|
|
export function isPluginSettingKeySecretLike(value: string): boolean {
|
|
return SECRET_LIKE_SETTING_KEY_PATTERN.test(value);
|
|
}
|
|
|
|
export function isSafePluginSettingKey(value: unknown): value is string {
|
|
return isPluginSettingKeyFormatSafe(value) && !isPluginSettingKeyReserved(value) && !isPluginSettingKeySecretLike(value);
|
|
}
|
|
|
|
export function isPluginSettingValue(value: unknown): value is PluginSettingValue {
|
|
return isPluginSettingValueShapeSafe(value) && isPluginSettingValueWithinSize(value);
|
|
}
|
|
|
|
export function isPluginSettingValueShapeSafe(
|
|
value: unknown,
|
|
depth = 0,
|
|
budget: { nodes: number; seen: WeakSet<object> } = { nodes: 0, seen: new WeakSet<object>() }
|
|
): value is PluginSettingValue {
|
|
budget.nodes += 1;
|
|
if (depth > PLUGIN_SETTING_VALUE_MAX_DEPTH || budget.nodes > PLUGIN_SETTING_VALUE_MAX_NODES) return false;
|
|
if (value === null) return true;
|
|
if (typeof value === "string" || typeof value === "boolean") return true;
|
|
if (typeof value === "number") return Number.isFinite(value);
|
|
if (typeof value === "object" && value !== null) {
|
|
if (budget.seen.has(value)) return false;
|
|
budget.seen.add(value);
|
|
}
|
|
if (Array.isArray(value)) {
|
|
if (value.length > PLUGIN_SETTING_ARRAY_MAX_LENGTH) return false;
|
|
return value.every((item) => isPluginSettingValueShapeSafe(item, depth + 1, budget));
|
|
}
|
|
if (!isPlainPluginSettingsObject(value)) return false;
|
|
const entries = Object.entries(value);
|
|
if (entries.length > PLUGIN_SETTING_OBJECT_MAX_KEYS) return false;
|
|
return entries.every(
|
|
([key, nested]) => !isPluginSettingKeyReserved(key) && !isPluginSettingKeySecretLike(key) && isPluginSettingValueShapeSafe(nested, depth + 1, budget)
|
|
);
|
|
}
|
|
|
|
export function isPluginSettingValueWithinSize(value: PluginSettingValue): boolean {
|
|
return getUtf8ByteLength(JSON.stringify(value)) <= PLUGIN_SETTING_VALUE_MAX_BYTES;
|
|
}
|
|
|
|
function isPlainPluginSettingsObject(value: unknown): value is Record<string, unknown> {
|
|
if (!value || typeof value !== "object" || Array.isArray(value)) return false;
|
|
const prototype = Object.getPrototypeOf(value);
|
|
return prototype === Object.prototype || prototype === null;
|
|
}
|
|
|
|
function getUtf8ByteLength(value: string): number {
|
|
return new TextEncoder().encode(value).length;
|
|
}
|